;;; GNU Guix --- Functional package management for GNU ;;; Copyright © 2013, 2014, 2015, 2016, 2017, 2019, 2020 Ludovic Courtès <ludo@gnu.org> ;;; ;;; This file is part of GNU Guix. ;;; ;;; GNU Guix is free software; you can redistribute it and/or modify it ;;; under the terms of the GNU General Public License as published by ;;; the Free Software Foundation; either version 3 of the License, or (at ;;; your option) any later version. ;;; ;;; GNU Guix is distributed in the hope that it will be useful, but ;;; WITHOUT ANY WARRANTY; without even the implied warranty of ;;; MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the ;;; GNU General Public License for more details. ;;; ;;; You should have received a copy of the GNU General Public License ;;; along with GNU Guix. If not, see <http://www.gnu.org/licenses/>. (define-module (gnu system pam) #:use-module (guix records) #:use-module (guix derivations) #:use-module (guix gexp) #:use-module (gnu services) #:use-module (ice-9 match) #:use-module (srfi srfi-1) #:use-module (srfi srfi-9) </td></tr></table> <table class='tabs'><tr><td> <a href='/guix/about/'>about</a><a href='/guix/'>summary</a><a href='/guix/refs/?id=93f21e1a35eec940be754fea0303cc649eacd395'>refs</a><a href='/guix/log/gnu/packages/tls.scm'>log</a><a href='/guix/tree/gnu/packages/tls.scm?id=93f21e1a35eec940be754fea0303cc649eacd395'>tree</a><a class='active' href='/guix/commit/gnu/packages/tls.scm?id=93f21e1a35eec940be754fea0303cc649eacd395'>commit</a><a href='/guix/diff/gnu/packages/tls.scm?id=93f21e1a35eec940be754fea0303cc649eacd395'>diff</a></td><td class='form'><form class='right' method='get' action='/guix/log/gnu/packages/tls.scm'> <input type='hidden' name='id' value='93f21e1a35eec940be754fea0303cc649eacd395'/><select name='qt'> <option value='grep'>log msg</option> <option value='author'>author</option> <option value='committer'>committer</option> <option value='range'>range</option> </select> <input class='txt' type='search' size='10' name='q' value=''/> <input type='submit' value='search'/> </form> </td></tr></table> <div class='path'>path: <a href='/guix/commit/?id=93f21e1a35eec940be754fea0303cc649eacd395'>root</a>/<a href='/guix/commit/gnu?id=93f21e1a35eec940be754fea0303cc649eacd395'>gnu</a>/<a href='/guix/commit/gnu/packages?id=93f21e1a35eec940be754fea0303cc649eacd395'>packages</a>/<a href='/guix/commit/gnu/packages/tls.scm?id=93f21e1a35eec940be754fea0303cc649eacd395'>tls.scm</a></div><div class='content'><div class='cgit-panel'><b>diff options</b><form method='get'><input type='hidden' name='id' value='93f21e1a35eec940be754fea0303cc649eacd395'/><table><tr><td colspan='2'/></tr><tr><td class='label'>context:</td><td class='ctrl'><select name='context' onchange='this.form.submit();'><option value='1'>1</option><option value='2'>2</option><option value='3' selected='selected'>3</option><option value='4'>4</option><option value='5'>5</option><option value='6'>6</option><option value='7'>7</option><option value='8'>8</option><option value='9'>9</option><option value='10'>10</option><option value='15'>15</option><option value='20'>20</option><option value='25'>25</option><option value='30'>30</option><option value='35'>35</option><option value='40'>40</option></select></td></tr><tr><td class='label'>space:</td><td class='ctrl'><select name='ignorews' onchange='this.form.submit();'><option value='0' selected='selected'>include</option><option value='1'>ignore</option></select></td></tr><tr><td class='label'>mode:</td><td class='ctrl'><select name='dt' onchange='this.form.submit();'><option value='0' selected='selected'>unified</option><option value='1'>ssdiff</option><option value='2'>stat only</option></select></td></tr><tr><td/><td class='ctrl'><noscript><input type='submit' value='reload'/></noscript></td></tr></table></form></div><table summary='commit info' class='commit-info'> <tr><th>author</th><td>Chris Marusich <cmmarusich@gmail.com></td><td class='right'>2021-02-21 19:48:26 -0800</td></tr> <tr><th>committer</th><td>Chris Marusich <cmmarusich@gmail.com></td><td class='right'>2021-03-23 23:19:58 -0700</td></tr> <tr><th>commit</th><td colspan='2' class='oid'><a href='/guix/commit/gnu/packages/tls.scm?id=93f21e1a35eec940be754fea0303cc649eacd395'>93f21e1a35eec940be754fea0303cc649eacd395</a> (<a href='/guix/patch/gnu/packages/tls.scm?id=93f21e1a35eec940be754fea0303cc649eacd395'>patch</a>)</td></tr> <tr><th>tree</th><td colspan='2' class='oid'><a href='/guix/tree/?id=93f21e1a35eec940be754fea0303cc649eacd395'>ae2ad2b6257f29ffb944ed5b310d28ce42140dd6</a> /<a href='/guix/tree/gnu/packages/tls.scm?id=93f21e1a35eec940be754fea0303cc649eacd395'>gnu/packages/tls.scm</a></td></tr> <tr><th>parent</th><td colspan='2' class='oid'><a href='/guix/commit/gnu/packages/tls.scm?id=8d9aece8c499e536d36c97f11fa8a55325ad4db6'>8d9aece8c499e536d36c97f11fa8a55325ad4db6</a> (<a href='/guix/diff/gnu/packages/tls.scm?id=93f21e1a35eec940be754fea0303cc649eacd395&id2=8d9aece8c499e536d36c97f11fa8a55325ad4db6'>diff</a>)</td></tr><tr><th>download</th><td colspan='2' class='oid'><a href='/guix/snapshot/guix-93f21e1a35eec940be754fea0303cc649eacd395.tar.gz'>guix-93f21e1a35eec940be754fea0303cc649eacd395.tar.gz</a><br/><a href='/guix/snapshot/guix-93f21e1a35eec940be754fea0303cc649eacd395.zip'>guix-93f21e1a35eec940be754fea0303cc649eacd395.zip</a><br/></td></tr></table> <div class='commit-subject'>utils: Fix target-64bit? on powerpc64le-linux.</div><div class='commit-msg'>* guix/utils.scm (target-64bit?): Change the string from "ppc64" to "powerpc64", which matches Guix system names like "powerpc64le-linux". </div><div class='diffstat-header'><a href='/guix/diff/?id=93f21e1a35eec940be754fea0303cc649eacd395'>Diffstat</a> (limited to 'gnu/packages/tls.scm')</div><table summary='diffstat' class='diffstat'></table><div class='diffstat-summary'>0 files changed, 0 insertions, 0 deletions</div><table summary='diff' class='diff'><tr><td></td></tr></table></div> <!-- class=content --> <div class=footer>generated by <a href="https://git.zx2c4.com/cgit/about/"> cgit </a> </div> </div> <!-- id=cgit --> </body> </html> (srfi srfi-1)) (mkdir #$output) (for-each (match-lambda ((name file) (symlink file (string-append #$output "/" name)))) ;; Since <pam-service> objects cannot be compared with ;; 'equal?' since they contain gexps, which contain ;; closures, use 'delete-duplicates' on the build-side ;; instead. See <http://bugs.gnu.org/20037>. (delete-duplicates '#$(zip names files))))) (computed-file "pam.d" builder))) (define %pam-other-services ;; The "other" PAM configuration, which denies everything (see ;; <http://www.linux-pam.org/Linux-PAM-html/sag-configuration-example.html>.) (let ((deny (pam-entry (control "required") (module "pam_deny.so")))) (pam-service (name "other") (account (list deny)) (auth (list deny)) (password (list deny)) (session (list deny))))) (define unix-pam-service (let ((unix (pam-entry (control "required") (module "pam_unix.so"))) (env (pam-entry ; to honor /etc/environment. (control "required") (module "pam_env.so")))) (lambda* (name #:key allow-empty-passwords? (allow-root? #f) motd login-uid?) "Return a standard Unix-style PAM service for NAME. When ALLOW-EMPTY-PASSWORDS? is true, allow empty passwords. When ALLOW-ROOT? is true, allow root to run the command without authentication. When MOTD is true, it should be a file-like object used as the message-of-the-day. When LOGIN-UID? is true, require the 'pam_loginuid' module; that module sets /proc/self/loginuid, which the libc 'getlogin' function relies on." ;; See <http://www.linux-pam.org/Linux-PAM-html/sag-configuration-example.html>. (pam-service (name name) (account (list unix)) (auth (append (if allow-root? (list (pam-entry (control "sufficient") (module "pam_rootok.so"))) '()) (list (if allow-empty-passwords? (pam-entry (control "required") (module "pam_unix.so") (arguments '("nullok"))) unix)))) (password (list (pam-entry (control "required") (module "pam_unix.so") ;; Store SHA-512 encrypted passwords in /etc/shadow. (arguments '("sha512" "shadow"))))) (session `(,@(if motd (list (pam-entry (control "optional") (module "pam_motd.so") (arguments (list #~(string-append "motd=" #$motd))))) '()) ,@(if login-uid? (list (pam-entry ;to fill in /proc/self/loginuid (control "required") (module "pam_loginuid.so"))) '()) ,env ,unix)))))) (define (rootok-pam-service command) "Return a PAM service for COMMAND such that 'root' does not need to authenticate to run COMMAND." (let ((unix (pam-entry (control "required") (module "pam_unix.so")))) (pam-service (name command) (account (list unix)) (auth (list (pam-entry (control "sufficient") (module "pam_rootok.so")))) (password (list unix)) (session (list unix))))) (define* (base-pam-services #:key allow-empty-passwords?) "Return the list of basic PAM services everyone would want." ;; TODO: Add other Shadow programs? (append (list %pam-other-services) ;; These programs are setuid-root. (map (cut unix-pam-service <> #:allow-empty-passwords? allow-empty-passwords?) '("passwd" "sudo")) ;; This is setuid-root, as well. Allow root to run "su" without ;; authenticating. (list (unix-pam-service "su" #:allow-empty-passwords? allow-empty-passwords? #:allow-root? #t)) ;; These programs are not setuid-root, and we want root to be able ;; to run them without having to authenticate (notably because ;; 'useradd' and 'groupadd' are run during system activation.) (map rootok-pam-service '("useradd" "userdel" "usermod" "groupadd" "groupdel" "groupmod")))) ;;; ;;; System-wide environment variables. ;;; (define (environment-variables->environment-file vars) "Return a file for pam_env(8) that contains environment variables VARS." (apply mixed-text-file "environment" (append-map (match-lambda ((key . value) (list key "=" value "\n"))) vars))) (define session-environment-service-type (service-type (name 'session-environment) (extensions (list (service-extension etc-service-type (lambda (vars) (list `("environment" ,(environment-variables->environment-file vars))))))) (compose concatenate) (extend append) (description "Populate @file{/etc/environment}, which is honored by @code{pam_env}, with the specified environment variables. The value of this service is a list of name/value pairs for environments variables, such as: @example '((\"TZ\" . \"Canada/Pacific\")) @end example\n"))) (define (session-environment-service vars) "Return a service that builds the @file{/etc/environment}, which can be read by PAM-aware applications to set environment variables for sessions. VARS should be an association list in which both the keys and the values are strings or string-valued gexps." (service session-environment-service-type vars)) ;;; ;;; PAM root service. ;;; ;; Overall PAM configuration: a list of services, plus a procedure that takes ;; one <pam-service> and returns a <pam-service>. The procedure is used to ;; implement cross-cutting concerns such as the use of the 'elogind.so' ;; session module that keeps track of logged-in users. (define-record-type* <pam-configuration> pam-configuration make-pam-configuration? pam-configuration? (services pam-configuration-services) ;list of <pam-service> (transform pam-configuration-transform)) ;procedure (define (/etc-entry config) "Return the /etc/pam.d entry corresponding to CONFIG." (match config (($ <pam-configuration> services transform) (let ((services (map transform services))) `(("pam.d" ,(pam-services->directory services))))))) (define (extend-configuration initial extensions) "Extend INITIAL with NEW." (let-values (((services procs) (partition pam-service? extensions))) (pam-configuration (services (append (pam-configuration-services initial) services)) (transform (apply compose (pam-configuration-transform initial) procs))))) (define pam-root-service-type (service-type (name 'pam) (extensions (list (service-extension etc-service-type /etc-entry))) ;; Arguments include <pam-service> as well as procedures. (compose concatenate) (extend extend-configuration) (description "Configure the Pluggable Authentication Modules (PAM) for all the specified @dfn{PAM services}. Each PAM service corresponds to a program, such as @command{login} or @command{sshd}, and specifies for instance how the program may authenticate users or what it should do when opening a new session."))) (define* (pam-root-service base #:key (transform identity)) "The \"root\" PAM service, which collects <pam-service> instance and turns them into a /etc/pam.d directory, including the <pam-service> listed in BASE. TRANSFORM is a procedure that takes a <pam-service> and returns a <pam-service>. It can be used to implement cross-cutting concerns that affect all the PAM services." (service pam-root-service-type (pam-configuration (services base) (transform transform))))